# System-Encryption: Voidlinux

*First off:
I do know, that there already exists a Wiki-Article on this in the [Voidlinux-Wiki](https://wiki.voidlinux.eu/Install_LVM_LUKS), however these are my personal adjustments and configurations that I would like to share, as well as bringing some structure and explaination into this.*


**VERY IMPORTANT:** 
Do NOT - I repeat: Do NOT - follow this Tutorial blindly. Think about every step you take and don't copy'n'paste comands from here, without adjusting them to your system. Please read everything VERY carefully and don't get distracted.
Anything in here can seriously harm your system or cause data-loss, if you don't pay attention.
**YOU HAVE BEEN WARNED.**



## Table of Contents
1. [Why Encryption?](#why-encryption)
2. [Assumptions (for this Tutorial)](#assumptions)
3. [Disk Preparations](#disk-preparations)
4. [Disk Partitioning](#disk-partitioning)
5. [Filesystem Creation](#filesystem-creation)
	* [**/boot** directory](#boot-directory)
	* [**/** directory](#-directory)
6. [Installation](#installation)
	* [Mounting the Filesystem, installing the Base-System](#mounting-the-filesystem-and-installing-the-base-system)
	* [Configuring the System](#configuring-your-new-system)
7. [Optional: SWAP](#optional-swap)
	* [encrypted SWAP](#encrypted-swap)
	* [un-encrypted SWAP](#normal-unencrypted-swap)
8. [Rebooting and Post-Install](#rebooting-and-post-install)
9. [Sources and Referal-Links](#sources-and-referal-links)



## Why encryption?
Please read the Article on the Parentfolder of this Tutorial **(coming soon)**.



## Assumptions
This Tutorial will assume, that you booted a x86 (32-bit or 64-bit) Netinstall ISO-image of [Voidlinux](http://repo.voidlinux.eu/live/current/), from either a thumbdrive or CD. You may want to [check the integrity](https://notabug.org/jayvii/Tutorials/src/master/File-Validation:%20SHA-2) of the Image with the SHA-2 hash [provided by Voidlinux](http://repo.voidlinux.eu/live/current/sha256sums.txt).
Also, this Tutorial will assume, you are using a legacy BIOS system with a single HDD.


## Disk Preparations
In order to create a secure encryption, you first need to wipe the entire Disk and write random numbers (0|1) to it.

**AGAIN:** I said "**wipe the entire disk**". This means, that any data that has been on there previously will be irrevocably destroyed. Please do backups of all important data you have to an external device, prior to this.


Once you booted into the Voidlinux livesession **as ROOT** (follow the onscreen instructions for doing so), find out which label your HDD has:
```
lsblk
```

In this example, it has the label **sda**, but others are possible as well (sdb, sdc, sdd, ...):
```
NAME           MAJ:MIN RM   SIZE RO TYPE  MOUNTPOINT
sda              8:0    0   640G  0 disk
```


Having this information, you first need to create a *temporary* encryption-container with a random key created by `/dev/random`:
```
cryptsetup open --type plain /dev/sda container --key-file /dev/random
```

You can check, if the container has been properly created with `lsblk` or `fdisk -l`.


Finally, use `dd` to write zeros to the container, using its encryption cipher to randomize the numbers (0|1), that are actually written to the disk. 
This is a bit faster, and more reliable than directly writing `/dev/random` or `/dev/urandom` to the HDD.
Either way, depending on your disk's size, this will take a **LONG** time. `status=progress` is used to check the current progress:
```
dd if=/dev/zero of=/dev/mapper/container status=progress
```


When the process has finished, remove the temporary container and move on to [partitioning the disk](#disk-partitioning):
```
cryptsetup close container
```


## Disk Partitioning
For partitioning, I will use `cfdisk`, but you can use your prefered tool (eg.: fdisk, parted, ...).
You need **at least** `/` and `/boot`, eventhough having a SWAP-partition is recommended as well.
*Note: When asked, what type of partition-table you want to create, choose "MBR"*
```
cfdisk /dev/sda
```


Now, create your first partition `/dev/sda1` with a size between 512-1024MB. This will be the `/boot` partition and has to hold your Linux-Kernel(s), so keep in mind to adjust its size for your needs and set the "**Bootable**" flag.
*Optional: Create your second partition `/dev/sda2` with a size about double your physical RAM to use it as SWAP-space.*

Lastly, use the remaining space to create a partition for your `/` directory.
*Optional: You can also put `/home` on a seperate partition, if you want to. Keep in mind, that legacy BIOS systems can only hold 4 primary partitions, so you may want to use logicals, if you need more than that.*
After that, move on to [creating your filesystems](#filesystem-creation).



## Filesystem Creation

#### /boot directory
As the first step of creating you filesystems, create your partition, intended to be `/boot` as ext2.
Note, that the `/boot` partition will remain unencrypted, as the bootloader (eg: gurb, lilo, ...) has to be able to read it. If you **really** want an encrypted `/boot` partition, read the appropriate section in the [Voidlinux-Wiki](https://wiki.voidlinux.eu/Install_LVM_LUKS_on_UEFI_GPT):
```
mkfs.ext2 -L boot /dev/sda1
```


#### / directory
Next will be the `/` directory, for which you first have to create a LUKS crypt-container.
*Note: I will assume, that you created a swap-partition on `/dev/sda2`, so `/dev/sda3` would be your root-partition.*
```
cryptsetup luksFormat /dev/sda3
cryptsetup luksOpen /dev/sda3 crypt-root
```


Inside of that, create a LVM crypt-pool.
Note, that my HDD is 640GB in size. Subtracting 1GB for `/boot` and 8GB for `swap`, results in a 631GB partition for `/`:
```
vgcreate voidlinux /dev/mapper/crypt-root
lvcreate --name root -L 631G voidlinux
```


Now, create an ext4 filesystem for your `/` partition:
```
mkfs.ext4 -L root /dev/mapper/voidlinux-root
```


If you decided to go with a seperate `/home` partition, redo [the last few steps](#-directory) for that partition and adjust them accordingly.

Afterwards, continue with the next step and start [installing the system](#installation).
*Note: I will ignore the SWAP-partition for now.*



## Installation

#### Mounting the Filesystem and installing the Base-System
First off, mount your encrypted `/` directory to the livesession's `/mnt`:
```
mount /dev/mapper/voidlinux-root /mnt
```


Secondly, create `/mnt/boot`, `/mnt/dev`, `/mnt/proc` and `/mnt/sys`.
*Note: `mkdir /mnt/{boot,dev,proc,sys}` gave me issues with the livesession's shell.*
```
mkdir /mnt/boot
mkdir /mnt/dev
mkdir /mnt/proc
mdkir /mnt/sys
```


Next, mount your unencrypted `/boot` directory to the livesession's `/mnt/boot`:
```
mount /dev/sda1 /mnt/boot
```


As a fourth step, bind the livesessions systemdirs to the remaining folders:
```
mount --rbind /dev /mnt/dev
mount --rbind /proc /mnt/proc
mount --rbind /sys /mnt/sys
```


Now, you can finally start to install the base-system, your bootloader and the encryption/decryption packages to your system's `/` directory, located on the livesession's `/mnt`.
*Note: You can also use "lilo", instead of "grub", if you know how to configure it correctly.*
```
xbps-install -S -R http://repo.voidlinux.eu/current -r /mnt base-system grub lvm2 cryptsetup
```


#### Configuring your new System
In order to configure your new system (still mounted to the livesession's `/mnt`), you need to chroot into its shell (here: bash):
```
chroot /mnt /bin/bash
```


Once you are in, set a **secure** password to ROOT, set it as owner of the `/` directory and make sure, that only ROOT has write-access to it:
```
passwd root
chown root:root /
chmod 755 /
```


Afterwards, edit your system's `/etc/rc.conf`.
Here you can set its "*Hostname*", "*Hardwareclock*", "*Timezone*", default "*Keymap*", console "*Fonts*" and number of "*TTYs*".
You also need to leave your "*Hostname*" in `/etc/hostname` (just your hostname, nothing else).
*Note: In this example, "vi" is used as text-editor, but you can install any CLI-editor with xbps-install, if you don't like vi*:
```
vi /etc/rc.conf
vi /etc/hostname
```


Next, edit your `/etc/fstab`. [See below for an example](#fstab-example):
```
vi /etc/fstab
```
###### FStab-Example
```
/dev/sda1 /boot ext2 defaults 0 0
/dev/mapper/voidlinux-root / ext4 defaults 0 1
```


Afterwards, let GRUB configure itself (if you choose lilo, you obviously have to configure that one instead now).

Also, add "*rd.auto=1*" to "*GRUBCMDLINELINUX_DEFAULT*" in your `/etc/default/grub`
*Note: If you want to use an alternative keymap for typing in your LUKS-passphrase, add "rd.vconsole.keymap=KEYMMAP" to "GRUBCMDLINELINUX_DEFAULT" as well and replace "KEYMAP" with the one, you want to use.*
```
grub-install /dev/sda
vi /etc/default/grub
```


As soon, as you configured your bootloader, configure and update your locales, replacing "*en_US*" with the locales you want to use (eg: *de_DE*):
```
echo "LANG=en_US.UTF-8" > /etc/locale.conf
echo "en_US.UTF-8 UTF-8" >> /etc/default/libc-locales
xbps-reconfigure -f glibc-locales
```


Lastly, configure dracut and reconfigure the kernel, to accept the dracut and grub adjustments.
*Note: replace "linux4.3" with the kernel-version of your just installed system (Check the version-number of the [linux-package](https://github.com/voidlinux/void-packages/blob/master/srcpkgs/linux/template)).*
```
xbps-reconfigure -f linux4.3
```



## OPTIONAL: SWAP

#### encrypted SWAP
In systems, where suspend to disk (hibernate) is no desired feature, you can encrypt your swap-space with a randomly generated key. Your system will generate a new key at each boot, thus destroying the content, which has been stored to it, previously.
Since it is rather risky to tell your system to destroy all data on a device like `/dev/sda2`, as this could lead to the loss of your data, in case your devices' name or partition table changes for some reason, a tiny unencrypted portion of the partition can store its UUID and LABEL.

For that, you first have to create a 1MiB ext2 filesystem on your swap-partition and receive its UUID:
```
mkfs.ext2 -L cryptswap /dev/sda2 1M
blkid /dev/sda2
```


Now, tell "crypttab" to create a new swap-file with a randomly generated key at each boot, by editing your `/etc/crypttab`. [See below for an example](#crypttab-example):
```
vi /etc/crypttab
```
###### Crypttab-Example
```
# <name>       <device>         <password>              <options>
cryptswap      LABEL=cryptswap  /dev/urandom            swap,offset=2048,cipher=aes-xts-plain64,size=512
```


Next, edit your `/etc/fstab` and add the new swap-file. [See below for an example](#swap-fstab-example) (including the previously created `/etc/fstab`):
```
vi /etc/fstab
```
###### SWAP-FStab-Example
```
/dev/sda1 /boot ext2 defaults 0 1
/dev/mapper/cryptswap none swap defaults 0 0
/dev/mapper/voidlinux-root / ext4 defaults 0 1
```


### normal (unencrypted) SWAP
If you do not worry about someone being able to read out, what has been on your SWAP before, you do not need to encrypt it.
Simply create a standard swap-space on the intended partition and add it to your `/etc/fstab`. [See below for an example](#swap-example):
```
mkswap /dev/sda2
vi /etc/fstab
```
###### SWAP-Example
```
/dev/sda1 /boot ext2 defaults 0 1
/dev/sda2 none swap defaults 0 0
/dev/mapper/voidlinux-root / ext4 defaults 0 1
```



## Rebooting and Post-Install
After following [all steps above](#installation), press **CTRL** + **D**, to exit your system's shell (or type `exit`).
Reboot your system and continue with the Post-Install, described in the [Voidlinux-Wiki](https://wiki.voidlinux.eu/Post_Installation).
```
reboot
```


## Sources and Referal-Links
* [Voidlinux: Wiki](https://wiki.voidlinux.eu/Main_Page)
* [Voidlinux: Packages](http://www.voidlinux.eu/packages/)
* [Voidlinux: Install LVM LUKS](https://wiki.voidlinux.eu/Install_LVM_LUKS)
* [Archlinux: DM-Crypt](https://wiki.archlinux.org/index.php/Dm-crypt)
* [Archlinux: SWAP](https://wiki.archlinux.org/index.php/Swap)

